CVE-2024-53197
Linux Kernel Out-of-Bounds Access Vulnerability
Description
CVE-2024-53197 is a high-severity out-of-bounds write vulnerability in the Linux kernel's ALSA USB-audio driver affecting Extigy and Mbox devices. The flaw occurs because a malicious USB device can provide a bNumConfigurations value exceeding the initial allocation used by usb_get_configuration, leading to out-of-bounds memory accesses during device configuration handling and destruction. With a CVSS v3.1 score of 7.8 and its addition to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of April 30, 2025, this Linux kernel security vulnerability poses a serious risk to systems that process USB audio devices, potentially enabling an attacker to achieve arbitrary code execution with kernel privileges.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| linux | linux kernel | >= 2.6.12, < 4.19.325; >= 4.20, < 5.4.287; >= 5.5, < 5.10.231; >= 5.11, < 5.15.174; >= 5.16, < 6.1.120; >= 6.2, < 6.6.64; >= 6.7, < 6.11.11; >= 6.12, < 6.12.2 |
| debian | debian linux | 11.0 |
References
- https://git.kernel.org/stable/c/0b4ea4bfe16566b84645ded1403756a2dc4e0f19(Patch)
- https://git.kernel.org/stable/c/379d3b9799d9da953391e973b934764f01e03960(Patch)
- https://git.kernel.org/stable/c/62dc01c83fa71e10446ee4c31e0e3d5d1291e865(Patch)
- https://git.kernel.org/stable/c/920a369a9f014f10ec282fd298d0666129379f1b(Patch)
- https://git.kernel.org/stable/c/9887d859cd60727432a01564e8f91302d361b72b(Patch)
- https://git.kernel.org/stable/c/9b8460a2a7ce478e0b625af7c56d444dc24190f7(Patch)
- https://git.kernel.org/stable/c/b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca(Patch)
- https://git.kernel.org/stable/c/b8f8b81dabe52b413fe9e062e8a852c48dd0680d(Patch)
- https://git.kernel.org/stable/c/b909df18ce2a998afef81d58bbd1a05dc0788c40(Patch)
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html(Mailing List)
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-53197(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2024-53197 is classified under CWE-787 (Out-of-bounds Write), a weakness where software writes data past the end or before the beginning of an intended buffer. In the Linux kernel's USB-audio driver, the Extigy and Mbox device handling code trusts the bNumConfigurations value reported by the USB device without validating it against the allocation size of dev->config. A malicious device can report a larger number of configurations than what was initially allocated, causing subsequent code paths including usb_destroy_configuration to write beyond the allocated buffer.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2024-53197 carries a CVSS v3.1 score of 7.8 (High), with maximum impact across all three CIA dimensions. The vulnerability requires local access (AV:L) through a USB device interface and low privileges (PR:L), but demands no user interaction (UI:N) and has low attack complexity (AC:L). Confidentiality, integrity, and availability are all rated High because an out-of-bounds write in kernel space can be leveraged to overwrite critical kernel data structures, enabling arbitrary code execution with kernel privileges, data corruption, or a complete system crash. Unlike read-only vulnerabilities, a write primitive in kernel memory is significantly more dangerous as it can be chained with other techniques to achieve full system compromise. The EPSS score of 1.6% at the 81th percentile indicates that exploitation is being tracked as a tangible risk, and the vulnerability's presence in the KEV catalog confirms real-world exploitation activity.
Exploit Maturity
CVE-2024-53197 has been confirmed as actively exploited in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog with an April 30, 2025 remediation deadline. The EPSS score of 1.6% at the 81th percentile indicates possible but not yet widespread exploitation. Multiple kernel patch commits are publicly available across stable branches, providing detailed insight into the vulnerability mechanism. The exploit requires local USB access, but in targeted attack scenarios involving physical access or supply chain compromises of USB peripherals, the out-of-bounds write primitive makes this a high-value vulnerability for attackers seeking kernel-level code execution.
Remediation
-
Update the Linux kernel to a patched version immediately. Fixed versions include 4.19.325+, 5.4.287+, 5.10.231+, 5.15.174+, 6.1.120+, 6.6.64+, 6.11.11+, and 6.12.2+ for their respective branches. Debian 11 users should apply the latest kernel packages from the LTS security repository.
-
Restrict USB device connections on sensitive systems. Deploy USB device management tools such as usbguard to create allowlists of trusted USB devices. Deny all unknown USB audio devices, particularly on servers and workstations in sensitive environments.
-
Blacklist the snd-usb-audio module on systems that do not require USB audio functionality. Add
blacklist snd-usb-audioto/etc/modprobe.d/blacklist.confto prevent the vulnerable driver from loading when a USB audio device is connected. -
Audit systems for indicators of compromise. Check kernel logs (
dmesg) for unexpected USB device enumeration events, crashes in usb_destroy_configuration or snd-usb-audio code paths, and any suspicious USB device connection patterns. Enable and review kernel crash dumps. -
Implement defense-in-depth by enabling kernel hardening features such as KASLR, SMEP, SMAP, and stack protector. These mitigations increase the difficulty of reliably exploiting out-of-bounds write vulnerabilities even when the underlying bug is present.
Technical Details
CVE-2024-53197 is an out-of-bounds write vulnerability in the Linux kernel's ALSA USB-audio driver, specifically in the code handling Extigy and Mbox USB audio devices. The CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a locally exploitable flaw with complete impact on confidentiality, integrity, and availability. The root cause lies in the device configuration handling: when a USB device is enumerated, usb_get_configuration allocates the dev->config array based on an initial bNumConfigurations value. However, a malicious USB device can subsequently report a different, larger bNumConfigurations value that exceeds this allocation. The Extigy and Mbox specific code paths in the USB-audio driver access dev->config using the device-reported configuration count without revalidating it against the actual allocation size. This leads to out-of-bounds accesses in multiple locations, including usb_destroy_configuration during device teardown. The fix validates the bNumConfigurations value against the allocation size to prevent any access beyond the allocated config array. The vulnerability spans a wide range of kernel versions from 2.6.12 through 6.12.1.
Frequently Asked Questions
Is CVE-2024-53197 being actively exploited?
Yes. CISA has confirmed active exploitation by including CVE-2024-53197 in the Known Exploited Vulnerabilities catalog. The remediation deadline is April 30, 2025, indicating urgency. The EPSS score of 1.6% at the 81th percentile shows measurable exploitation probability.
What products are affected by CVE-2024-53197?
The vulnerability affects the Linux kernel from version 2.6.12 through 6.12.1, spanning nearly all actively maintained kernel branches. Debian Linux 11 is also confirmed as affected. Any system running the snd-usb-audio kernel module with USB audio support enabled is potentially at risk.
How do I fix CVE-2024-53197?
Update to a patched Linux kernel version for your branch (4.19.325+, 5.4.287+, 5.10.231+, 5.15.174+, 6.1.120+, 6.6.64+, 6.11.11+, or 6.12.2+). As an interim measure, blacklist the snd-usb-audio module and restrict USB device access.
How severe is CVE-2024-53197?
With a CVSS score of 7.8 (High), CVE-2024-53197 enables kernel-level code execution through an out-of-bounds write. While local USB access is required, the ability to achieve arbitrary kernel code execution makes this a critical threat for systems accessible to untrusted USB devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.